2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Copyright (C) Andrew Tridgell 1992-1997,
5 * Copyright (C) Luke Kenneth Casson Leighton 1996-1997,
6 * Copyright (C) Paul Ashton 1997,
7 * Copyright (C) Jeremy Allison 2001, 2006.
8 * Copyright (C) Rafal Szczesniak 2002,
9 * Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2002,
10 * Copyright (C) Simo Sorce 2003.
11 * Copyright (C) Gerald (Jerry) Carter 2005.
12 * Copyright (C) Volker Lendecke 2005.
13 * Copyright (C) Guenther Deschner 2008.
15 * This program is free software; you can redistribute it and/or modify
16 * it under the terms of the GNU General Public License as published by
17 * the Free Software Foundation; either version 3 of the License, or
18 * (at your option) any later version.
20 * This program is distributed in the hope that it will be useful,
21 * but WITHOUT ANY WARRANTY; without even the implied warranty of
22 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
23 * GNU General Public License for more details.
25 * You should have received a copy of the GNU General Public License
26 * along with this program; if not, see <http://www.gnu.org/licenses/>.
29 /* This is the implementation of the lsa server code. */
34 #define DBGC_CLASS DBGC_RPC_SRV
36 #define MAX_LOOKUP_SIDS 0x5000 /* 20480 */
45 const struct generic_mapping lsa_generic_mapping
= {
52 /***************************************************************************
53 init_lsa_ref_domain_list - adds a domain if it's not already in, returns the index.
54 ***************************************************************************/
56 static int init_lsa_ref_domain_list(TALLOC_CTX
*mem_ctx
,
57 struct lsa_RefDomainList
*ref
,
63 if (dom_name
!= NULL
) {
64 for (num
= 0; num
< ref
->count
; num
++) {
65 if (sid_equal(dom_sid
, ref
->domains
[num
].sid
)) {
73 if (num
>= LSA_REF_DOMAIN_LIST_MULTIPLIER
) {
74 /* index not found, already at maximum domain limit */
79 ref
->max_size
= LSA_REF_DOMAIN_LIST_MULTIPLIER
;
81 ref
->domains
= TALLOC_REALLOC_ARRAY(mem_ctx
, ref
->domains
,
82 struct lsa_DomainInfo
, ref
->count
);
87 ZERO_STRUCT(ref
->domains
[num
]);
89 init_lsa_StringLarge(&ref
->domains
[num
].name
, dom_name
);
90 ref
->domains
[num
].sid
= sid_dup_talloc(mem_ctx
, dom_sid
);
91 if (!ref
->domains
[num
].sid
) {
99 /*******************************************************************
100 Function to free the per handle data.
101 ********************************************************************/
103 static void free_lsa_info(void *ptr
)
105 struct lsa_info
*lsa
= (struct lsa_info
*)ptr
;
110 /***************************************************************************
111 initialize a lsa_DomainInfo structure.
112 ***************************************************************************/
114 static void init_dom_query_3(struct lsa_DomainInfo
*r
,
118 init_lsa_StringLarge(&r
->name
, name
);
122 /***************************************************************************
123 initialize a lsa_DomainInfo structure.
124 ***************************************************************************/
126 static void init_dom_query_5(struct lsa_DomainInfo
*r
,
130 init_lsa_StringLarge(&r
->name
, name
);
134 /***************************************************************************
135 lookup_lsa_rids. Must be called as root for lookup_name to work.
136 ***************************************************************************/
138 static NTSTATUS
lookup_lsa_rids(TALLOC_CTX
*mem_ctx
,
139 struct lsa_RefDomainList
*ref
,
140 struct lsa_TranslatedSid
*prid
,
141 uint32_t num_entries
,
142 struct lsa_String
*name
,
144 uint32_t *pmapped_count
)
146 uint32 mapped_count
, i
;
148 SMB_ASSERT(num_entries
<= MAX_LOOKUP_SIDS
);
153 for (i
= 0; i
< num_entries
; i
++) {
157 const char *full_name
;
159 enum lsa_SidType type
= SID_NAME_UNKNOWN
;
161 /* Split name into domain and user component */
163 full_name
= name
[i
].string
;
164 if (full_name
== NULL
) {
165 return NT_STATUS_NO_MEMORY
;
168 DEBUG(5, ("lookup_lsa_rids: looking up name %s\n", full_name
));
170 /* We can ignore the result of lookup_name, it will not touch
171 "type" if it's not successful */
173 lookup_name(mem_ctx
, full_name
, flags
, &domain
, NULL
,
178 case SID_NAME_DOM_GRP
:
179 case SID_NAME_DOMAIN
:
181 case SID_NAME_WKN_GRP
:
182 DEBUG(5, ("init_lsa_rids: %s found\n", full_name
));
183 /* Leave these unchanged */
186 /* Don't hand out anything but the list above */
187 DEBUG(5, ("init_lsa_rids: %s not found\n", full_name
));
188 type
= SID_NAME_UNKNOWN
;
195 if (type
!= SID_NAME_UNKNOWN
) {
196 sid_split_rid(&sid
, &rid
);
197 dom_idx
= init_lsa_ref_domain_list(mem_ctx
, ref
, domain
, &sid
);
201 init_lsa_translated_sid(&prid
[i
], type
, rid
, dom_idx
);
204 *pmapped_count
= mapped_count
;
208 /***************************************************************************
209 lookup_lsa_sids. Must be called as root for lookup_name to work.
210 ***************************************************************************/
212 static NTSTATUS
lookup_lsa_sids(TALLOC_CTX
*mem_ctx
,
213 struct lsa_RefDomainList
*ref
,
214 struct lsa_TranslatedSid3
*trans_sids
,
215 uint32_t num_entries
,
216 struct lsa_String
*name
,
218 uint32
*pmapped_count
)
220 uint32 mapped_count
, i
;
222 SMB_ASSERT(num_entries
<= MAX_LOOKUP_SIDS
);
227 for (i
= 0; i
< num_entries
; i
++) {
231 const char *full_name
;
233 enum lsa_SidType type
= SID_NAME_UNKNOWN
;
237 /* Split name into domain and user component */
239 full_name
= name
[i
].string
;
240 if (full_name
== NULL
) {
241 return NT_STATUS_NO_MEMORY
;
244 DEBUG(5, ("init_lsa_sids: looking up name %s\n", full_name
));
246 /* We can ignore the result of lookup_name, it will not touch
247 "type" if it's not successful */
249 lookup_name(mem_ctx
, full_name
, flags
, &domain
, NULL
,
254 case SID_NAME_DOM_GRP
:
255 case SID_NAME_DOMAIN
:
257 case SID_NAME_WKN_GRP
:
258 DEBUG(5, ("init_lsa_sids: %s found\n", full_name
));
259 /* Leave these unchanged */
262 /* Don't hand out anything but the list above */
263 DEBUG(5, ("init_lsa_sids: %s not found\n", full_name
));
264 type
= SID_NAME_UNKNOWN
;
271 if (type
!= SID_NAME_UNKNOWN
) {
273 sid_copy(&domain_sid
, &sid
);
274 sid_split_rid(&domain_sid
, &rid
);
275 dom_idx
= init_lsa_ref_domain_list(mem_ctx
, ref
, domain
, &domain_sid
);
279 /* Initialize the lsa_TranslatedSid3 return. */
280 trans_sids
[i
].sid_type
= type
;
281 trans_sids
[i
].sid
= sid_dup_talloc(mem_ctx
, &sid
);
282 trans_sids
[i
].sid_index
= dom_idx
;
285 *pmapped_count
= mapped_count
;
289 static NTSTATUS
lsa_get_generic_sd(TALLOC_CTX
*mem_ctx
, SEC_DESC
**sd
, size_t *sd_size
)
291 DOM_SID local_adm_sid
;
298 init_sec_ace(&ace
[0], &global_sid_World
, SEC_ACE_TYPE_ACCESS_ALLOWED
, LSA_POLICY_EXECUTE
, 0);
300 sid_copy(&adm_sid
, get_global_sam_sid());
301 sid_append_rid(&adm_sid
, DOMAIN_GROUP_RID_ADMINS
);
302 init_sec_ace(&ace
[1], &adm_sid
, SEC_ACE_TYPE_ACCESS_ALLOWED
, LSA_POLICY_ALL_ACCESS
, 0);
304 sid_copy(&local_adm_sid
, &global_sid_Builtin
);
305 sid_append_rid(&local_adm_sid
, BUILTIN_ALIAS_RID_ADMINS
);
306 init_sec_ace(&ace
[2], &local_adm_sid
, SEC_ACE_TYPE_ACCESS_ALLOWED
, LSA_POLICY_ALL_ACCESS
, 0);
308 if((psa
= make_sec_acl(mem_ctx
, NT4_ACL_REVISION
, 3, ace
)) == NULL
)
309 return NT_STATUS_NO_MEMORY
;
311 if((*sd
= make_sec_desc(mem_ctx
, SECURITY_DESCRIPTOR_REVISION_1
,
312 SEC_DESC_SELF_RELATIVE
, &adm_sid
, NULL
, NULL
,
313 psa
, sd_size
)) == NULL
)
314 return NT_STATUS_NO_MEMORY
;
319 #if 0 /* AD DC work in ongoing in Samba 4 */
321 /***************************************************************************
323 ***************************************************************************/
325 static void init_dns_dom_info(LSA_DNS_DOM_INFO
*r_l
, const char *nb_name
,
326 const char *dns_name
, const char *forest_name
,
327 struct GUID
*dom_guid
, DOM_SID
*dom_sid
)
329 if (nb_name
&& *nb_name
) {
330 init_unistr2(&r_l
->uni_nb_dom_name
, nb_name
, UNI_FLAGS_NONE
);
331 init_uni_hdr(&r_l
->hdr_nb_dom_name
, &r_l
->uni_nb_dom_name
);
332 r_l
->hdr_nb_dom_name
.uni_max_len
+= 2;
333 r_l
->uni_nb_dom_name
.uni_max_len
+= 1;
336 if (dns_name
&& *dns_name
) {
337 init_unistr2(&r_l
->uni_dns_dom_name
, dns_name
, UNI_FLAGS_NONE
);
338 init_uni_hdr(&r_l
->hdr_dns_dom_name
, &r_l
->uni_dns_dom_name
);
339 r_l
->hdr_dns_dom_name
.uni_max_len
+= 2;
340 r_l
->uni_dns_dom_name
.uni_max_len
+= 1;
343 if (forest_name
&& *forest_name
) {
344 init_unistr2(&r_l
->uni_forest_name
, forest_name
, UNI_FLAGS_NONE
);
345 init_uni_hdr(&r_l
->hdr_forest_name
, &r_l
->uni_forest_name
);
346 r_l
->hdr_forest_name
.uni_max_len
+= 2;
347 r_l
->uni_forest_name
.uni_max_len
+= 1;
350 /* how do we init the guid ? probably should write an init fn */
352 memcpy(&r_l
->dom_guid
, dom_guid
, sizeof(struct GUID
));
356 r_l
->ptr_dom_sid
= 1;
357 init_dom_sid2(&r_l
->dom_sid
, dom_sid
);
360 #endif /* AD DC work in ongoing in Samba 4 */
363 /***************************************************************************
365 ***************************************************************************/
367 NTSTATUS
_lsa_OpenPolicy2(pipes_struct
*p
,
368 struct lsa_OpenPolicy2
*r
)
370 struct lsa_info
*info
;
371 SEC_DESC
*psd
= NULL
;
373 uint32 des_access
= r
->in
.access_mask
;
378 /* map the generic bits to the lsa policy ones */
379 se_map_generic(&des_access
, &lsa_generic_mapping
);
381 /* get the generic lsa policy SD until we store it */
382 lsa_get_generic_sd(p
->mem_ctx
, &psd
, &sd_size
);
384 status
= se_access_check(psd
, p
->pipe_user
.nt_user_token
, des_access
, &acc_granted
);
385 if (!NT_STATUS_IS_OK(status
)) {
386 if (p
->pipe_user
.ut
.uid
!= sec_initial_uid()) {
389 DEBUG(4,("ACCESS should be DENIED (granted: %#010x; required: %#010x)\n",
390 acc_granted
, des_access
));
391 DEBUGADD(4,("but overwritten by euid == 0\n"));
394 /* This is needed for lsa_open_account and rpcclient .... :-) */
396 if (p
->pipe_user
.ut
.uid
== sec_initial_uid())
397 acc_granted
= LSA_POLICY_ALL_ACCESS
;
399 /* associate the domain SID with the (unique) handle. */
400 if ((info
= SMB_MALLOC_P(struct lsa_info
)) == NULL
)
401 return NT_STATUS_NO_MEMORY
;
404 sid_copy(&info
->sid
,get_global_sam_sid());
405 info
->access
= acc_granted
;
407 /* set up the LSA QUERY INFO response */
408 if (!create_policy_hnd(p
, r
->out
.handle
, free_lsa_info
, (void *)info
))
409 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
414 /***************************************************************************
416 ***************************************************************************/
418 NTSTATUS
_lsa_OpenPolicy(pipes_struct
*p
,
419 struct lsa_OpenPolicy
*r
)
421 struct lsa_info
*info
;
422 SEC_DESC
*psd
= NULL
;
424 uint32 des_access
= r
->in
.access_mask
;
429 /* map the generic bits to the lsa policy ones */
430 se_map_generic(&des_access
, &lsa_generic_mapping
);
432 /* get the generic lsa policy SD until we store it */
433 lsa_get_generic_sd(p
->mem_ctx
, &psd
, &sd_size
);
435 status
= se_access_check(psd
, p
->pipe_user
.nt_user_token
, des_access
, &acc_granted
);
436 if (!NT_STATUS_IS_OK(status
)) {
437 if (p
->pipe_user
.ut
.uid
!= sec_initial_uid()) {
440 DEBUG(4,("ACCESS should be DENIED (granted: %#010x; required: %#010x)\n",
441 acc_granted
, des_access
));
442 DEBUGADD(4,("but overwritten by euid == 0\n"));
443 acc_granted
= des_access
;
446 /* associate the domain SID with the (unique) handle. */
447 if ((info
= SMB_MALLOC_P(struct lsa_info
)) == NULL
)
448 return NT_STATUS_NO_MEMORY
;
451 sid_copy(&info
->sid
,get_global_sam_sid());
452 info
->access
= acc_granted
;
454 /* set up the LSA QUERY INFO response */
455 if (!create_policy_hnd(p
, r
->out
.handle
, free_lsa_info
, (void *)info
))
456 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
461 /***************************************************************************
462 _lsa_EnumTrustDom - this needs fixing to do more than return NULL ! JRA.
464 ***************************************************************************/
466 NTSTATUS
_lsa_EnumTrustDom(pipes_struct
*p
,
467 struct lsa_EnumTrustDom
*r
)
469 struct lsa_info
*info
;
471 struct trustdom_info
**domains
;
472 struct lsa_DomainInfo
*lsa_domains
= NULL
;
476 * preferred length is set to 5 as a "our" preferred length
477 * nt sets this parameter to 2
478 * update (20.08.2002): it's not preferred length, but preferred size!
479 * it needs further investigation how to optimally choose this value
481 uint32 max_num_domains
=
482 r
->in
.max_size
< 5 ? r
->in
.max_size
: 10;
487 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&info
))
488 return NT_STATUS_INVALID_HANDLE
;
490 /* check if the user has enough rights */
491 if (!(info
->access
& LSA_POLICY_VIEW_LOCAL_INFORMATION
))
492 return NT_STATUS_ACCESS_DENIED
;
495 nt_status
= pdb_enum_trusteddoms(p
->mem_ctx
, &num_domains
, &domains
);
498 if (!NT_STATUS_IS_OK(nt_status
)) {
502 if (*r
->in
.resume_handle
< num_domains
) {
503 num_thistime
= MIN(num_domains
, max_num_domains
);
505 nt_status
= STATUS_MORE_ENTRIES
;
507 if (*r
->in
.resume_handle
+ num_thistime
> num_domains
) {
508 num_thistime
= num_domains
- *r
->in
.resume_handle
;
509 nt_status
= NT_STATUS_OK
;
512 next_idx
= *r
->in
.resume_handle
+ num_thistime
;
515 next_idx
= 0xffffffff;
516 nt_status
= NT_STATUS_NO_MORE_ENTRIES
;
519 /* set up the lsa_enum_trust_dom response */
521 lsa_domains
= TALLOC_ZERO_ARRAY(p
->mem_ctx
, struct lsa_DomainInfo
,
524 return NT_STATUS_NO_MEMORY
;
527 for (i
=0; i
<num_thistime
; i
++) {
528 init_lsa_StringLarge(&lsa_domains
[i
].name
, domains
[i
]->name
);
529 lsa_domains
[i
].sid
= &domains
[i
]->sid
;
532 *r
->out
.resume_handle
= next_idx
;
533 r
->out
.domains
->count
= num_thistime
;
534 r
->out
.domains
->domains
= lsa_domains
;
539 #define LSA_AUDIT_NUM_CATEGORIES_NT4 7
540 #define LSA_AUDIT_NUM_CATEGORIES_WIN2K 9
541 #define LSA_AUDIT_NUM_CATEGORIES LSA_AUDIT_NUM_CATEGORIES_NT4
543 /***************************************************************************
545 ***************************************************************************/
547 NTSTATUS
_lsa_QueryInfoPolicy(pipes_struct
*p
,
548 struct lsa_QueryInfoPolicy
*r
)
550 NTSTATUS status
= NT_STATUS_OK
;
551 struct lsa_info
*handle
;
555 union lsa_PolicyInformation
*info
= NULL
;
557 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&handle
))
558 return NT_STATUS_INVALID_HANDLE
;
560 info
= TALLOC_ZERO_P(p
->mem_ctx
, union lsa_PolicyInformation
);
562 return NT_STATUS_NO_MEMORY
;
565 switch (r
->in
.level
) {
569 uint32 policy_def
= LSA_AUDIT_POLICY_ALL
;
571 /* check if the user has enough rights */
572 if (!(handle
->access
& LSA_POLICY_VIEW_AUDIT_INFORMATION
)) {
573 DEBUG(10,("_lsa_QueryInfoPolicy: insufficient access rights\n"));
574 return NT_STATUS_ACCESS_DENIED
;
577 /* fake info: We audit everything. ;) */
579 info
->audit_events
.auditing_mode
= true;
580 info
->audit_events
.count
= LSA_AUDIT_NUM_CATEGORIES
;
581 info
->audit_events
.settings
= TALLOC_ZERO_ARRAY(p
->mem_ctx
,
582 enum lsa_PolicyAuditPolicy
,
583 info
->audit_events
.count
);
584 if (!info
->audit_events
.settings
) {
585 return NT_STATUS_NO_MEMORY
;
588 info
->audit_events
.settings
[LSA_AUDIT_CATEGORY_ACCOUNT_MANAGEMENT
] = policy_def
;
589 info
->audit_events
.settings
[LSA_AUDIT_CATEGORY_FILE_AND_OBJECT_ACCESS
] = policy_def
;
590 info
->audit_events
.settings
[LSA_AUDIT_CATEGORY_LOGON
] = policy_def
;
591 info
->audit_events
.settings
[LSA_AUDIT_CATEGORY_PROCCESS_TRACKING
] = policy_def
;
592 info
->audit_events
.settings
[LSA_AUDIT_CATEGORY_SECURITY_POLICY_CHANGES
] = policy_def
;
593 info
->audit_events
.settings
[LSA_AUDIT_CATEGORY_SYSTEM
] = policy_def
;
594 info
->audit_events
.settings
[LSA_AUDIT_CATEGORY_USE_OF_USER_RIGHTS
] = policy_def
;
599 /* check if the user has enough rights */
600 if (!(handle
->access
& LSA_POLICY_VIEW_LOCAL_INFORMATION
))
601 return NT_STATUS_ACCESS_DENIED
;
603 /* Request PolicyPrimaryDomainInformation. */
604 switch (lp_server_role()) {
605 case ROLE_DOMAIN_PDC
:
606 case ROLE_DOMAIN_BDC
:
607 name
= get_global_sam_name();
608 sid
= sid_dup_talloc(p
->mem_ctx
, get_global_sam_sid());
610 return NT_STATUS_NO_MEMORY
;
613 case ROLE_DOMAIN_MEMBER
:
614 name
= lp_workgroup();
615 /* We need to return the Domain SID here. */
616 if (secrets_fetch_domain_sid(lp_workgroup(), &domain_sid
)) {
617 sid
= sid_dup_talloc(p
->mem_ctx
, &domain_sid
);
619 return NT_STATUS_NO_MEMORY
;
622 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO
;
625 case ROLE_STANDALONE
:
626 name
= lp_workgroup();
630 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO
;
632 init_dom_query_3(&info
->domain
, name
, sid
);
635 /* check if the user has enough rights */
636 if (!(handle
->access
& LSA_POLICY_VIEW_LOCAL_INFORMATION
))
637 return NT_STATUS_ACCESS_DENIED
;
639 /* Request PolicyAccountDomainInformation. */
640 name
= get_global_sam_name();
641 sid
= get_global_sam_sid();
643 init_dom_query_5(&info
->account_domain
, name
, sid
);
646 /* check if the user has enough rights */
647 if (!(handle
->access
& LSA_POLICY_VIEW_LOCAL_INFORMATION
))
648 return NT_STATUS_ACCESS_DENIED
;
650 switch (lp_server_role()) {
651 case ROLE_DOMAIN_BDC
:
653 * only a BDC is a backup controller
654 * of the domain, it controls.
660 * any other role is a primary
661 * of the domain, it controls.
668 DEBUG(0,("_lsa_QueryInfoPolicy: unknown info level in Lsa Query: %d\n",
670 status
= NT_STATUS_INVALID_INFO_CLASS
;
679 /***************************************************************************
680 _lsa_lookup_sids_internal
681 ***************************************************************************/
683 static NTSTATUS
_lsa_lookup_sids_internal(pipes_struct
*p
,
685 uint16_t level
, /* input */
686 int num_sids
, /* input */
687 struct lsa_SidPtr
*sid
, /* input */
688 struct lsa_RefDomainList
**pp_ref
, /* input/output */
689 struct lsa_TranslatedName2
**pp_names
,/* input/output */
690 uint32_t *pp_mapped_count
) /* input/output */
694 const DOM_SID
**sids
= NULL
;
695 struct lsa_RefDomainList
*ref
= NULL
;
696 uint32 mapped_count
= 0;
697 struct lsa_dom_info
*dom_infos
= NULL
;
698 struct lsa_name_info
*name_infos
= NULL
;
699 struct lsa_TranslatedName2
*names
= NULL
;
701 *pp_mapped_count
= 0;
709 sids
= TALLOC_ARRAY(p
->mem_ctx
, const DOM_SID
*, num_sids
);
710 ref
= TALLOC_ZERO_P(p
->mem_ctx
, struct lsa_RefDomainList
);
712 if (sids
== NULL
|| ref
== NULL
) {
713 return NT_STATUS_NO_MEMORY
;
716 for (i
=0; i
<num_sids
; i
++) {
717 sids
[i
] = sid
[i
].sid
;
720 status
= lookup_sids(p
->mem_ctx
, num_sids
, sids
, level
,
721 &dom_infos
, &name_infos
);
723 if (!NT_STATUS_IS_OK(status
)) {
727 names
= TALLOC_ARRAY(p
->mem_ctx
, struct lsa_TranslatedName2
, num_sids
);
729 return NT_STATUS_NO_MEMORY
;
732 for (i
=0; i
<LSA_REF_DOMAIN_LIST_MULTIPLIER
; i
++) {
734 if (!dom_infos
[i
].valid
) {
738 if (init_lsa_ref_domain_list(mem_ctx
, ref
,
740 &dom_infos
[i
].sid
) != i
) {
741 DEBUG(0, ("Domain %s mentioned twice??\n",
743 return NT_STATUS_INTERNAL_ERROR
;
747 for (i
=0; i
<num_sids
; i
++) {
748 struct lsa_name_info
*name
= &name_infos
[i
];
750 if (name
->type
== SID_NAME_UNKNOWN
) {
753 /* Unknown sids should return the string
754 * representation of the SID. Windows 2003 behaves
755 * rather erratic here, in many cases it returns the
756 * RID as 8 bytes hex, in others it returns the full
757 * SID. We (Jerry/VL) could not figure out which the
758 * hard cases are, so leave it with the SID. */
759 name
->name
= talloc_asprintf(p
->mem_ctx
, "%s",
762 if (name
->name
== NULL
) {
763 return NT_STATUS_NO_MEMORY
;
769 init_lsa_translated_name2(&names
[i
], name
->type
,
770 name
->name
, name
->dom_idx
, 0);
773 status
= NT_STATUS_NONE_MAPPED
;
774 if (mapped_count
> 0) {
775 status
= (mapped_count
< num_sids
) ?
776 STATUS_SOME_UNMAPPED
: NT_STATUS_OK
;
779 DEBUG(10, ("num_sids %d, mapped_count %d, status %s\n",
780 num_sids
, mapped_count
, nt_errstr(status
)));
782 *pp_mapped_count
= mapped_count
;
789 /***************************************************************************
791 ***************************************************************************/
793 NTSTATUS
_lsa_LookupSids(pipes_struct
*p
,
794 struct lsa_LookupSids
*r
)
797 struct lsa_info
*handle
;
798 int num_sids
= r
->in
.sids
->num_sids
;
799 uint32 mapped_count
= 0;
800 struct lsa_RefDomainList
*domains
= NULL
;
801 struct lsa_TranslatedName
*names_out
= NULL
;
802 struct lsa_TranslatedName2
*names
= NULL
;
805 if ((r
->in
.level
< 1) || (r
->in
.level
> 6)) {
806 return NT_STATUS_INVALID_PARAMETER
;
809 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&handle
)) {
810 return NT_STATUS_INVALID_HANDLE
;
813 /* check if the user has enough rights */
814 if (!(handle
->access
& LSA_POLICY_LOOKUP_NAMES
)) {
815 return NT_STATUS_ACCESS_DENIED
;
818 if (num_sids
> MAX_LOOKUP_SIDS
) {
819 DEBUG(5,("_lsa_LookupSids: limit of %d exceeded, requested %d\n",
820 MAX_LOOKUP_SIDS
, num_sids
));
821 return NT_STATUS_NONE_MAPPED
;
824 status
= _lsa_lookup_sids_internal(p
,
833 /* Convert from lsa_TranslatedName2 to lsa_TranslatedName */
834 names_out
= TALLOC_ARRAY(p
->mem_ctx
, struct lsa_TranslatedName
,
837 return NT_STATUS_NO_MEMORY
;
840 for (i
=0; i
<num_sids
; i
++) {
841 names_out
[i
].sid_type
= names
[i
].sid_type
;
842 names_out
[i
].name
= names
[i
].name
;
843 names_out
[i
].sid_index
= names
[i
].sid_index
;
846 *r
->out
.domains
= domains
;
847 r
->out
.names
->count
= num_sids
;
848 r
->out
.names
->names
= names_out
;
849 *r
->out
.count
= mapped_count
;
854 /***************************************************************************
856 ***************************************************************************/
858 NTSTATUS
_lsa_LookupSids2(pipes_struct
*p
,
859 struct lsa_LookupSids2
*r
)
862 struct lsa_info
*handle
;
863 int num_sids
= r
->in
.sids
->num_sids
;
864 uint32 mapped_count
= 0;
865 struct lsa_RefDomainList
*domains
= NULL
;
866 struct lsa_TranslatedName2
*names
= NULL
;
867 bool check_policy
= true;
869 switch (p
->hdr_req
.opnum
) {
870 case NDR_LSA_LOOKUPSIDS3
:
871 check_policy
= false;
873 case NDR_LSA_LOOKUPSIDS2
:
878 if ((r
->in
.level
< 1) || (r
->in
.level
> 6)) {
879 return NT_STATUS_INVALID_PARAMETER
;
883 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&handle
)) {
884 return NT_STATUS_INVALID_HANDLE
;
887 /* check if the user has enough rights */
888 if (!(handle
->access
& LSA_POLICY_LOOKUP_NAMES
)) {
889 return NT_STATUS_ACCESS_DENIED
;
893 if (num_sids
> MAX_LOOKUP_SIDS
) {
894 DEBUG(5,("_lsa_LookupSids2: limit of %d exceeded, requested %d\n",
895 MAX_LOOKUP_SIDS
, num_sids
));
896 return NT_STATUS_NONE_MAPPED
;
899 status
= _lsa_lookup_sids_internal(p
,
908 *r
->out
.domains
= domains
;
909 r
->out
.names
->count
= num_sids
;
910 r
->out
.names
->names
= names
;
911 *r
->out
.count
= mapped_count
;
916 /***************************************************************************
918 ***************************************************************************/
920 NTSTATUS
_lsa_LookupSids3(pipes_struct
*p
,
921 struct lsa_LookupSids3
*r
)
923 struct lsa_LookupSids2 q
;
925 /* No policy handle on this call. Restrict to crypto connections. */
926 if (p
->auth
.auth_type
!= PIPE_AUTH_TYPE_SCHANNEL
) {
927 DEBUG(0,("_lsa_LookupSids3: client %s not using schannel for netlogon\n",
928 get_remote_machine_name() ));
929 return NT_STATUS_INVALID_PARAMETER
;
933 q
.in
.sids
= r
->in
.sids
;
934 q
.in
.level
= r
->in
.level
;
935 q
.in
.unknown1
= r
->in
.unknown1
;
936 q
.in
.unknown2
= r
->in
.unknown2
;
937 q
.in
.names
= r
->in
.names
;
938 q
.in
.count
= r
->in
.count
;
940 q
.out
.domains
= r
->out
.domains
;
941 q
.out
.names
= r
->out
.names
;
942 q
.out
.count
= r
->out
.count
;
944 return _lsa_LookupSids2(p
, &q
);
947 /***************************************************************************
948 ***************************************************************************/
950 static int lsa_lookup_level_to_flags(uint16 level
)
956 flags
= LOOKUP_NAME_ALL
;
959 flags
= LOOKUP_NAME_DOMAIN
|LOOKUP_NAME_REMOTE
|LOOKUP_NAME_ISOLATED
;
962 flags
= LOOKUP_NAME_DOMAIN
|LOOKUP_NAME_ISOLATED
;
968 flags
= LOOKUP_NAME_NONE
;
975 /***************************************************************************
977 ***************************************************************************/
979 NTSTATUS
_lsa_LookupNames(pipes_struct
*p
,
980 struct lsa_LookupNames
*r
)
982 NTSTATUS status
= NT_STATUS_NONE_MAPPED
;
983 struct lsa_info
*handle
;
984 struct lsa_String
*names
= r
->in
.names
;
985 uint32 num_entries
= r
->in
.num_names
;
986 struct lsa_RefDomainList
*domains
= NULL
;
987 struct lsa_TranslatedSid
*rids
= NULL
;
988 uint32 mapped_count
= 0;
991 if (num_entries
> MAX_LOOKUP_SIDS
) {
992 num_entries
= MAX_LOOKUP_SIDS
;
993 DEBUG(5,("_lsa_LookupNames: truncating name lookup list to %d\n",
997 flags
= lsa_lookup_level_to_flags(r
->in
.level
);
999 domains
= TALLOC_ZERO_P(p
->mem_ctx
, struct lsa_RefDomainList
);
1001 return NT_STATUS_NO_MEMORY
;
1005 rids
= TALLOC_ZERO_ARRAY(p
->mem_ctx
, struct lsa_TranslatedSid
,
1008 return NT_STATUS_NO_MEMORY
;
1014 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&handle
)) {
1015 status
= NT_STATUS_INVALID_HANDLE
;
1019 /* check if the user has enough rights */
1020 if (!(handle
->access
& LSA_POLICY_LOOKUP_NAMES
)) {
1021 status
= NT_STATUS_ACCESS_DENIED
;
1025 /* set up the LSA Lookup RIDs response */
1026 become_root(); /* lookup_name can require root privs */
1027 status
= lookup_lsa_rids(p
->mem_ctx
, domains
, rids
, num_entries
,
1028 names
, flags
, &mapped_count
);
1033 if (NT_STATUS_IS_OK(status
) && (num_entries
!= 0) ) {
1034 if (mapped_count
== 0) {
1035 status
= NT_STATUS_NONE_MAPPED
;
1036 } else if (mapped_count
!= num_entries
) {
1037 status
= STATUS_SOME_UNMAPPED
;
1041 *r
->out
.count
= mapped_count
;
1042 *r
->out
.domains
= domains
;
1043 r
->out
.sids
->sids
= rids
;
1044 r
->out
.sids
->count
= num_entries
;
1049 /***************************************************************************
1051 ***************************************************************************/
1053 NTSTATUS
_lsa_LookupNames2(pipes_struct
*p
,
1054 struct lsa_LookupNames2
*r
)
1057 struct lsa_LookupNames q
;
1058 struct lsa_TransSidArray2
*sid_array2
= r
->in
.sids
;
1059 struct lsa_TransSidArray
*sid_array
= NULL
;
1062 sid_array
= TALLOC_ZERO_P(p
->mem_ctx
, struct lsa_TransSidArray
);
1064 return NT_STATUS_NO_MEMORY
;
1067 q
.in
.handle
= r
->in
.handle
;
1068 q
.in
.num_names
= r
->in
.num_names
;
1069 q
.in
.names
= r
->in
.names
;
1070 q
.in
.level
= r
->in
.level
;
1071 q
.in
.sids
= sid_array
;
1072 q
.in
.count
= r
->in
.count
;
1073 /* we do not know what this is for */
1074 /* = r->in.unknown1; */
1075 /* = r->in.unknown2; */
1077 q
.out
.domains
= r
->out
.domains
;
1078 q
.out
.sids
= sid_array
;
1079 q
.out
.count
= r
->out
.count
;
1081 status
= _lsa_LookupNames(p
, &q
);
1083 sid_array2
->sids
= TALLOC_ARRAY(p
->mem_ctx
, struct lsa_TranslatedSid2
, sid_array
->count
);
1084 if (!sid_array2
->sids
) {
1085 return NT_STATUS_NO_MEMORY
;
1088 for (i
=0; i
<sid_array
->count
; i
++) {
1089 sid_array2
->sids
[i
].sid_type
= sid_array
->sids
[i
].sid_type
;
1090 sid_array2
->sids
[i
].rid
= sid_array
->sids
[i
].rid
;
1091 sid_array2
->sids
[i
].sid_index
= sid_array
->sids
[i
].sid_index
;
1092 sid_array2
->sids
[i
].unknown
= 0;
1095 r
->out
.sids
= sid_array2
;
1100 /***************************************************************************
1102 ***************************************************************************/
1104 NTSTATUS
_lsa_LookupNames3(pipes_struct
*p
,
1105 struct lsa_LookupNames3
*r
)
1108 struct lsa_info
*handle
;
1109 struct lsa_String
*names
= r
->in
.names
;
1110 uint32 num_entries
= r
->in
.num_names
;
1111 struct lsa_RefDomainList
*domains
= NULL
;
1112 struct lsa_TranslatedSid3
*trans_sids
= NULL
;
1113 uint32 mapped_count
= 0;
1115 bool check_policy
= true;
1117 switch (p
->hdr_req
.opnum
) {
1118 case NDR_LSA_LOOKUPNAMES4
:
1119 check_policy
= false;
1121 case NDR_LSA_LOOKUPNAMES3
:
1123 check_policy
= true;
1126 if (num_entries
> MAX_LOOKUP_SIDS
) {
1127 num_entries
= MAX_LOOKUP_SIDS
;
1128 DEBUG(5,("_lsa_LookupNames3: truncating name lookup list to %d\n", num_entries
));
1131 /* Probably the lookup_level is some sort of bitmask. */
1132 if (r
->in
.level
== 1) {
1133 flags
= LOOKUP_NAME_ALL
;
1136 domains
= TALLOC_ZERO_P(p
->mem_ctx
, struct lsa_RefDomainList
);
1138 return NT_STATUS_NO_MEMORY
;
1142 trans_sids
= TALLOC_ZERO_ARRAY(p
->mem_ctx
, struct lsa_TranslatedSid3
,
1145 return NT_STATUS_NO_MEMORY
;
1153 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&handle
)) {
1154 status
= NT_STATUS_INVALID_HANDLE
;
1158 /* check if the user has enough rights */
1159 if (!(handle
->access
& LSA_POLICY_LOOKUP_NAMES
)) {
1160 status
= NT_STATUS_ACCESS_DENIED
;
1165 /* set up the LSA Lookup SIDs response */
1166 become_root(); /* lookup_name can require root privs */
1167 status
= lookup_lsa_sids(p
->mem_ctx
, domains
, trans_sids
, num_entries
,
1168 names
, flags
, &mapped_count
);
1173 if (NT_STATUS_IS_OK(status
)) {
1174 if (mapped_count
== 0) {
1175 status
= NT_STATUS_NONE_MAPPED
;
1176 } else if (mapped_count
!= num_entries
) {
1177 status
= STATUS_SOME_UNMAPPED
;
1181 *r
->out
.count
= mapped_count
;
1182 *r
->out
.domains
= domains
;
1183 r
->out
.sids
->sids
= trans_sids
;
1184 r
->out
.sids
->count
= num_entries
;
1189 /***************************************************************************
1191 ***************************************************************************/
1193 NTSTATUS
_lsa_LookupNames4(pipes_struct
*p
,
1194 struct lsa_LookupNames4
*r
)
1196 struct lsa_LookupNames3 q
;
1198 /* No policy handle on this call. Restrict to crypto connections. */
1199 if (p
->auth
.auth_type
!= PIPE_AUTH_TYPE_SCHANNEL
) {
1200 DEBUG(0,("_lsa_lookup_names4: client %s not using schannel for netlogon\n",
1201 get_remote_machine_name() ));
1202 return NT_STATUS_INVALID_PARAMETER
;
1206 q
.in
.num_names
= r
->in
.num_names
;
1207 q
.in
.names
= r
->in
.names
;
1208 q
.in
.level
= r
->in
.level
;
1209 q
.in
.lookup_options
= r
->in
.lookup_options
;
1210 q
.in
.client_revision
= r
->in
.client_revision
;
1211 q
.in
.sids
= r
->in
.sids
;
1212 q
.in
.count
= r
->in
.count
;
1214 q
.out
.domains
= r
->out
.domains
;
1215 q
.out
.sids
= r
->out
.sids
;
1216 q
.out
.count
= r
->out
.count
;
1218 return _lsa_LookupNames3(p
, &q
);
1221 /***************************************************************************
1222 _lsa_close. Also weird - needs to check if lsa handle is correct. JRA.
1223 ***************************************************************************/
1225 NTSTATUS
_lsa_Close(pipes_struct
*p
, struct lsa_Close
*r
)
1227 if (!find_policy_by_hnd(p
, r
->in
.handle
, NULL
)) {
1228 return NT_STATUS_INVALID_HANDLE
;
1231 close_policy_hnd(p
, r
->in
.handle
);
1232 ZERO_STRUCTP(r
->out
.handle
);
1233 return NT_STATUS_OK
;
1236 /***************************************************************************
1237 ***************************************************************************/
1239 NTSTATUS
_lsa_OpenSecret(pipes_struct
*p
, struct lsa_OpenSecret
*r
)
1241 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
1244 /***************************************************************************
1245 ***************************************************************************/
1247 NTSTATUS
_lsa_OpenTrustedDomain(pipes_struct
*p
, struct lsa_OpenTrustedDomain
*r
)
1249 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
1252 /***************************************************************************
1253 ***************************************************************************/
1255 NTSTATUS
_lsa_CreateTrustedDomain(pipes_struct
*p
, struct lsa_CreateTrustedDomain
*r
)
1257 return NT_STATUS_ACCESS_DENIED
;
1260 /***************************************************************************
1261 ***************************************************************************/
1263 NTSTATUS
_lsa_CreateSecret(pipes_struct
*p
, struct lsa_CreateSecret
*r
)
1265 return NT_STATUS_ACCESS_DENIED
;
1268 /***************************************************************************
1269 ***************************************************************************/
1271 NTSTATUS
_lsa_SetSecret(pipes_struct
*p
, struct lsa_SetSecret
*r
)
1273 return NT_STATUS_ACCESS_DENIED
;
1276 /***************************************************************************
1278 ***************************************************************************/
1280 NTSTATUS
_lsa_DeleteObject(pipes_struct
*p
,
1281 struct lsa_DeleteObject
*r
)
1283 return NT_STATUS_ACCESS_DENIED
;
1286 /***************************************************************************
1288 ***************************************************************************/
1290 NTSTATUS
_lsa_EnumPrivs(pipes_struct
*p
,
1291 struct lsa_EnumPrivs
*r
)
1293 struct lsa_info
*handle
;
1295 uint32 enum_context
= *r
->in
.resume_handle
;
1296 int num_privs
= count_all_privileges();
1297 struct lsa_PrivEntry
*entries
= NULL
;
1300 /* remember that the enum_context starts at 0 and not 1 */
1302 if ( enum_context
>= num_privs
)
1303 return NT_STATUS_NO_MORE_ENTRIES
;
1305 DEBUG(10,("_lsa_EnumPrivs: enum_context:%d total entries:%d\n",
1306 enum_context
, num_privs
));
1308 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&handle
))
1309 return NT_STATUS_INVALID_HANDLE
;
1311 /* check if the user has enough rights
1312 I don't know if it's the right one. not documented. */
1314 if (!(handle
->access
& LSA_POLICY_VIEW_LOCAL_INFORMATION
))
1315 return NT_STATUS_ACCESS_DENIED
;
1318 entries
= TALLOC_ZERO_ARRAY(p
->mem_ctx
, struct lsa_PrivEntry
, num_privs
);
1320 return NT_STATUS_NO_MEMORY
;
1326 for (i
= 0; i
< num_privs
; i
++) {
1327 if( i
< enum_context
) {
1329 init_lsa_StringLarge(&entries
[i
].name
, NULL
);
1331 entries
[i
].luid
.low
= 0;
1332 entries
[i
].luid
.high
= 0;
1335 init_lsa_StringLarge(&entries
[i
].name
, privs
[i
].name
);
1337 luid
= get_privilege_luid( &privs
[i
].se_priv
);
1339 entries
[i
].luid
.low
= luid
.luid
.low
;
1340 entries
[i
].luid
.high
= luid
.luid
.high
;
1344 enum_context
= num_privs
;
1346 *r
->out
.resume_handle
= enum_context
;
1347 r
->out
.privs
->count
= num_privs
;
1348 r
->out
.privs
->privs
= entries
;
1350 return NT_STATUS_OK
;
1353 /***************************************************************************
1354 _lsa_LookupPrivDisplayName
1355 ***************************************************************************/
1357 NTSTATUS
_lsa_LookupPrivDisplayName(pipes_struct
*p
,
1358 struct lsa_LookupPrivDisplayName
*r
)
1360 struct lsa_info
*handle
;
1361 const char *description
;
1362 struct lsa_StringLarge
*lsa_name
;
1364 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&handle
))
1365 return NT_STATUS_INVALID_HANDLE
;
1367 /* check if the user has enough rights */
1370 * I don't know if it's the right one. not documented.
1372 if (!(handle
->access
& LSA_POLICY_VIEW_LOCAL_INFORMATION
))
1373 return NT_STATUS_ACCESS_DENIED
;
1375 DEBUG(10,("_lsa_LookupPrivDisplayName: name = %s\n", r
->in
.name
->string
));
1377 description
= get_privilege_dispname(r
->in
.name
->string
);
1379 DEBUG(10,("_lsa_LookupPrivDisplayName: doesn't exist\n"));
1380 return NT_STATUS_NO_SUCH_PRIVILEGE
;
1383 DEBUG(10,("_lsa_LookupPrivDisplayName: display name = %s\n", description
));
1385 lsa_name
= TALLOC_ZERO_P(p
->mem_ctx
, struct lsa_StringLarge
);
1387 return NT_STATUS_NO_MEMORY
;
1390 init_lsa_StringLarge(lsa_name
, description
);
1392 *r
->out
.returned_language_id
= r
->in
.language_id
;
1393 *r
->out
.disp_name
= lsa_name
;
1395 return NT_STATUS_OK
;
1398 /***************************************************************************
1400 ***************************************************************************/
1402 NTSTATUS
_lsa_EnumAccounts(pipes_struct
*p
,
1403 struct lsa_EnumAccounts
*r
)
1405 struct lsa_info
*handle
;
1407 int i
, j
, num_entries
;
1409 struct lsa_SidPtr
*sids
= NULL
;
1411 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&handle
))
1412 return NT_STATUS_INVALID_HANDLE
;
1414 if (!(handle
->access
& LSA_POLICY_VIEW_LOCAL_INFORMATION
))
1415 return NT_STATUS_ACCESS_DENIED
;
1420 /* The only way we can currently find out all the SIDs that have been
1421 privileged is to scan all privileges */
1423 status
= privilege_enumerate_accounts(&sid_list
, &num_entries
);
1424 if (!NT_STATUS_IS_OK(status
)) {
1428 if (*r
->in
.resume_handle
>= num_entries
) {
1429 return NT_STATUS_NO_MORE_ENTRIES
;
1432 if (num_entries
- *r
->in
.resume_handle
) {
1433 sids
= TALLOC_ZERO_ARRAY(p
->mem_ctx
, struct lsa_SidPtr
,
1434 num_entries
- *r
->in
.resume_handle
);
1436 SAFE_FREE(sid_list
);
1437 return NT_STATUS_NO_MEMORY
;
1440 for (i
= *r
->in
.resume_handle
, j
= 0; i
< num_entries
; i
++, j
++) {
1441 sids
[j
].sid
= sid_dup_talloc(p
->mem_ctx
, &sid_list
[i
]);
1443 SAFE_FREE(sid_list
);
1444 return NT_STATUS_NO_MEMORY
;
1449 talloc_free(sid_list
);
1451 *r
->out
.resume_handle
= num_entries
;
1452 r
->out
.sids
->num_sids
= num_entries
;
1453 r
->out
.sids
->sids
= sids
;
1455 return NT_STATUS_OK
;
1458 /***************************************************************************
1460 ***************************************************************************/
1462 NTSTATUS
_lsa_GetUserName(pipes_struct
*p
,
1463 struct lsa_GetUserName
*r
)
1465 const char *username
, *domname
;
1466 struct lsa_String
*account_name
= NULL
;
1467 struct lsa_String
*authority_name
= NULL
;
1469 if (r
->in
.account_name
&&
1470 *r
->in
.account_name
) {
1471 return NT_STATUS_INVALID_PARAMETER
;
1474 if (r
->in
.authority_name
&&
1475 *r
->in
.authority_name
) {
1476 return NT_STATUS_INVALID_PARAMETER
;
1479 if (p
->server_info
->guest
) {
1481 * I'm 99% sure this is not the right place to do this,
1482 * global_sid_Anonymous should probably be put into the token
1483 * instead of the guest id -- vl
1485 if (!lookup_sid(p
->mem_ctx
, &global_sid_Anonymous
,
1486 &domname
, &username
, NULL
)) {
1487 return NT_STATUS_NO_MEMORY
;
1490 username
= p
->server_info
->sanitized_username
;
1491 domname
= pdb_get_domain(p
->server_info
->sam_account
);
1494 account_name
= TALLOC_P(p
->mem_ctx
, struct lsa_String
);
1495 if (!account_name
) {
1496 return NT_STATUS_NO_MEMORY
;
1498 init_lsa_String(account_name
, username
);
1500 if (r
->out
.authority_name
) {
1501 authority_name
= TALLOC_P(p
->mem_ctx
, struct lsa_String
);
1502 if (!authority_name
) {
1503 return NT_STATUS_NO_MEMORY
;
1505 init_lsa_String(authority_name
, domname
);
1508 *r
->out
.account_name
= account_name
;
1509 if (r
->out
.authority_name
) {
1510 *r
->out
.authority_name
= authority_name
;
1513 return NT_STATUS_OK
;
1516 /***************************************************************************
1518 ***************************************************************************/
1520 NTSTATUS
_lsa_CreateAccount(pipes_struct
*p
,
1521 struct lsa_CreateAccount
*r
)
1523 struct lsa_info
*handle
;
1524 struct lsa_info
*info
;
1526 /* find the connection policy handle. */
1527 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&handle
))
1528 return NT_STATUS_INVALID_HANDLE
;
1530 /* check if the user has enough rights */
1533 * I don't know if it's the right one. not documented.
1534 * but guessed with rpcclient.
1536 if (!(handle
->access
& LSA_POLICY_GET_PRIVATE_INFORMATION
))
1537 return NT_STATUS_ACCESS_DENIED
;
1539 /* check to see if the pipe_user is a Domain Admin since
1540 account_pol.tdb was already opened as root, this is all we have */
1542 if ( p
->pipe_user
.ut
.uid
!= sec_initial_uid()
1543 && !nt_token_check_domain_rid( p
->pipe_user
.nt_user_token
, DOMAIN_GROUP_RID_ADMINS
) )
1544 return NT_STATUS_ACCESS_DENIED
;
1546 if ( is_privileged_sid( r
->in
.sid
) )
1547 return NT_STATUS_OBJECT_NAME_COLLISION
;
1549 /* associate the user/group SID with the (unique) handle. */
1551 if ((info
= SMB_MALLOC_P(struct lsa_info
)) == NULL
)
1552 return NT_STATUS_NO_MEMORY
;
1555 info
->sid
= *r
->in
.sid
;
1556 info
->access
= r
->in
.access_mask
;
1558 /* get a (unique) handle. open a policy on it. */
1559 if (!create_policy_hnd(p
, r
->out
.acct_handle
, free_lsa_info
, (void *)info
))
1560 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
1562 return privilege_create_account( &info
->sid
);
1566 /***************************************************************************
1568 ***************************************************************************/
1570 NTSTATUS
_lsa_OpenAccount(pipes_struct
*p
,
1571 struct lsa_OpenAccount
*r
)
1573 struct lsa_info
*handle
;
1574 struct lsa_info
*info
;
1576 /* find the connection policy handle. */
1577 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&handle
))
1578 return NT_STATUS_INVALID_HANDLE
;
1580 /* check if the user has enough rights */
1583 * I don't know if it's the right one. not documented.
1584 * but guessed with rpcclient.
1586 if (!(handle
->access
& LSA_POLICY_GET_PRIVATE_INFORMATION
))
1587 return NT_STATUS_ACCESS_DENIED
;
1589 /* TODO: Fis the parsing routine before reenabling this check! */
1591 if (!lookup_sid(&handle
->sid
, dom_name
, name
, &type
))
1592 return NT_STATUS_ACCESS_DENIED
;
1594 /* associate the user/group SID with the (unique) handle. */
1595 if ((info
= SMB_MALLOC_P(struct lsa_info
)) == NULL
)
1596 return NT_STATUS_NO_MEMORY
;
1599 info
->sid
= *r
->in
.sid
;
1600 info
->access
= r
->in
.access_mask
;
1602 /* get a (unique) handle. open a policy on it. */
1603 if (!create_policy_hnd(p
, r
->out
.acct_handle
, free_lsa_info
, (void *)info
))
1604 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
1606 return NT_STATUS_OK
;
1609 /***************************************************************************
1610 _lsa_EnumPrivsAccount
1611 For a given SID, enumerate all the privilege this account has.
1612 ***************************************************************************/
1614 NTSTATUS
_lsa_EnumPrivsAccount(pipes_struct
*p
,
1615 struct lsa_EnumPrivsAccount
*r
)
1617 NTSTATUS status
= NT_STATUS_OK
;
1618 struct lsa_info
*info
=NULL
;
1620 PRIVILEGE_SET privileges
;
1621 struct lsa_PrivilegeSet
*priv_set
= NULL
;
1622 struct lsa_LUIDAttribute
*luid_attrs
= NULL
;
1625 /* find the connection policy handle. */
1626 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&info
))
1627 return NT_STATUS_INVALID_HANDLE
;
1629 if (!(info
->access
& LSA_POLICY_VIEW_LOCAL_INFORMATION
))
1630 return NT_STATUS_ACCESS_DENIED
;
1632 if ( !get_privileges_for_sids( &mask
, &info
->sid
, 1 ) )
1633 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
1635 privilege_set_init( &privileges
);
1637 if ( se_priv_to_privilege_set( &privileges
, &mask
) ) {
1639 DEBUG(10,("_lsa_EnumPrivsAccount: %s has %d privileges\n",
1640 sid_string_dbg(&info
->sid
),
1643 priv_set
= TALLOC_ZERO_P(p
->mem_ctx
, struct lsa_PrivilegeSet
);
1645 status
= NT_STATUS_NO_MEMORY
;
1649 luid_attrs
= TALLOC_ZERO_ARRAY(p
->mem_ctx
,
1650 struct lsa_LUIDAttribute
,
1653 status
= NT_STATUS_NO_MEMORY
;
1657 for (i
=0; i
<privileges
.count
; i
++) {
1658 luid_attrs
[i
].luid
.low
= privileges
.set
[i
].luid
.low
;
1659 luid_attrs
[i
].luid
.high
= privileges
.set
[i
].luid
.high
;
1660 luid_attrs
[i
].attribute
= privileges
.set
[i
].attr
;
1663 priv_set
->count
= privileges
.count
;
1664 priv_set
->unknown
= 0;
1665 priv_set
->set
= luid_attrs
;
1667 *r
->out
.privs
= priv_set
;
1669 status
= NT_STATUS_NO_SUCH_PRIVILEGE
;
1673 privilege_set_free( &privileges
);
1678 /***************************************************************************
1679 _lsa_GetSystemAccessAccount
1680 ***************************************************************************/
1682 NTSTATUS
_lsa_GetSystemAccessAccount(pipes_struct
*p
,
1683 struct lsa_GetSystemAccessAccount
*r
)
1685 struct lsa_info
*info
=NULL
;
1687 /* find the connection policy handle. */
1689 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&info
))
1690 return NT_STATUS_INVALID_HANDLE
;
1692 if (!(info
->access
& LSA_POLICY_VIEW_LOCAL_INFORMATION
))
1693 return NT_STATUS_ACCESS_DENIED
;
1695 if (!lookup_sid(p
->mem_ctx
, &info
->sid
, NULL
, NULL
, NULL
))
1696 return NT_STATUS_ACCESS_DENIED
;
1699 0x01 -> Log on locally
1700 0x02 -> Access this computer from network
1701 0x04 -> Log on as a batch job
1702 0x10 -> Log on as a service
1704 they can be ORed together
1707 *r
->out
.access_mask
= PR_LOG_ON_LOCALLY
| PR_ACCESS_FROM_NETWORK
;
1709 return NT_STATUS_OK
;
1712 /***************************************************************************
1713 update the systemaccount information
1714 ***************************************************************************/
1716 NTSTATUS
_lsa_SetSystemAccessAccount(pipes_struct
*p
,
1717 struct lsa_SetSystemAccessAccount
*r
)
1719 struct lsa_info
*info
=NULL
;
1722 /* find the connection policy handle. */
1723 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&info
))
1724 return NT_STATUS_INVALID_HANDLE
;
1726 /* check to see if the pipe_user is a Domain Admin since
1727 account_pol.tdb was already opened as root, this is all we have */
1729 if ( p
->pipe_user
.ut
.uid
!= sec_initial_uid()
1730 && !nt_token_check_domain_rid( p
->pipe_user
.nt_user_token
, DOMAIN_GROUP_RID_ADMINS
) )
1731 return NT_STATUS_ACCESS_DENIED
;
1733 if (!pdb_getgrsid(&map
, info
->sid
))
1734 return NT_STATUS_NO_SUCH_GROUP
;
1736 return pdb_update_group_mapping_entry(&map
);
1739 /***************************************************************************
1740 _lsa_AddPrivilegesToAccount
1741 For a given SID, add some privileges.
1742 ***************************************************************************/
1744 NTSTATUS
_lsa_AddPrivilegesToAccount(pipes_struct
*p
,
1745 struct lsa_AddPrivilegesToAccount
*r
)
1747 struct lsa_info
*info
= NULL
;
1749 struct lsa_PrivilegeSet
*set
= NULL
;
1751 /* find the connection policy handle. */
1752 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&info
))
1753 return NT_STATUS_INVALID_HANDLE
;
1755 /* check to see if the pipe_user is root or a Domain Admin since
1756 account_pol.tdb was already opened as root, this is all we have */
1758 if ( p
->pipe_user
.ut
.uid
!= sec_initial_uid()
1759 && !nt_token_check_domain_rid( p
->pipe_user
.nt_user_token
, DOMAIN_GROUP_RID_ADMINS
) )
1761 return NT_STATUS_ACCESS_DENIED
;
1765 if ( !privilege_set_to_se_priv( &mask
, set
) )
1766 return NT_STATUS_NO_SUCH_PRIVILEGE
;
1768 if ( !grant_privilege( &info
->sid
, &mask
) ) {
1769 DEBUG(3,("_lsa_AddPrivilegesToAccount: grant_privilege(%s) failed!\n",
1770 sid_string_dbg(&info
->sid
) ));
1771 DEBUG(3,("Privilege mask:\n"));
1772 dump_se_priv( DBGC_ALL
, 3, &mask
);
1773 return NT_STATUS_NO_SUCH_PRIVILEGE
;
1776 return NT_STATUS_OK
;
1779 /***************************************************************************
1780 _lsa_RemovePrivilegesFromAccount
1781 For a given SID, remove some privileges.
1782 ***************************************************************************/
1784 NTSTATUS
_lsa_RemovePrivilegesFromAccount(pipes_struct
*p
,
1785 struct lsa_RemovePrivilegesFromAccount
*r
)
1787 struct lsa_info
*info
= NULL
;
1789 struct lsa_PrivilegeSet
*set
= NULL
;
1791 /* find the connection policy handle. */
1792 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&info
))
1793 return NT_STATUS_INVALID_HANDLE
;
1795 /* check to see if the pipe_user is root or a Domain Admin since
1796 account_pol.tdb was already opened as root, this is all we have */
1798 if ( p
->pipe_user
.ut
.uid
!= sec_initial_uid()
1799 && !nt_token_check_domain_rid( p
->pipe_user
.nt_user_token
, DOMAIN_GROUP_RID_ADMINS
) )
1801 return NT_STATUS_ACCESS_DENIED
;
1806 if ( !privilege_set_to_se_priv( &mask
, set
) )
1807 return NT_STATUS_NO_SUCH_PRIVILEGE
;
1809 if ( !revoke_privilege( &info
->sid
, &mask
) ) {
1810 DEBUG(3,("_lsa_RemovePrivilegesFromAccount: revoke_privilege(%s) failed!\n",
1811 sid_string_dbg(&info
->sid
) ));
1812 DEBUG(3,("Privilege mask:\n"));
1813 dump_se_priv( DBGC_ALL
, 3, &mask
);
1814 return NT_STATUS_NO_SUCH_PRIVILEGE
;
1817 return NT_STATUS_OK
;
1820 /***************************************************************************
1822 ***************************************************************************/
1824 NTSTATUS
_lsa_QuerySecurity(pipes_struct
*p
,
1825 struct lsa_QuerySecurity
*r
)
1827 struct lsa_info
*handle
=NULL
;
1828 SEC_DESC
*psd
= NULL
;
1832 /* find the connection policy handle. */
1833 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&handle
))
1834 return NT_STATUS_INVALID_HANDLE
;
1836 /* check if the user has enough rights */
1837 if (!(handle
->access
& LSA_POLICY_VIEW_LOCAL_INFORMATION
))
1838 return NT_STATUS_ACCESS_DENIED
;
1840 switch (r
->in
.sec_info
) {
1842 /* SD contains only the owner */
1844 status
=lsa_get_generic_sd(p
->mem_ctx
, &psd
, &sd_size
);
1845 if(!NT_STATUS_IS_OK(status
))
1846 return NT_STATUS_NO_MEMORY
;
1849 if((*r
->out
.sdbuf
= make_sec_desc_buf(p
->mem_ctx
, sd_size
, psd
)) == NULL
)
1850 return NT_STATUS_NO_MEMORY
;
1853 /* SD contains only the ACL */
1855 status
=lsa_get_generic_sd(p
->mem_ctx
, &psd
, &sd_size
);
1856 if(!NT_STATUS_IS_OK(status
))
1857 return NT_STATUS_NO_MEMORY
;
1859 if((*r
->out
.sdbuf
= make_sec_desc_buf(p
->mem_ctx
, sd_size
, psd
)) == NULL
)
1860 return NT_STATUS_NO_MEMORY
;
1863 return NT_STATUS_INVALID_LEVEL
;
1869 #if 0 /* AD DC work in ongoing in Samba 4 */
1871 /***************************************************************************
1872 ***************************************************************************/
1874 NTSTATUS
_lsa_query_info2(pipes_struct
*p
, LSA_Q_QUERY_INFO2
*q_u
, LSA_R_QUERY_INFO2
*r_u
)
1876 struct lsa_info
*handle
;
1877 const char *nb_name
;
1878 char *dns_name
= NULL
;
1879 char *forest_name
= NULL
;
1880 DOM_SID
*sid
= NULL
;
1885 r_u
->status
= NT_STATUS_OK
;
1887 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&handle
))
1888 return NT_STATUS_INVALID_HANDLE
;
1890 switch (q_u
->info_class
) {
1892 /* check if the user has enough rights */
1893 if (!(handle
->access
& LSA_POLICY_VIEW_LOCAL_INFORMATION
))
1894 return NT_STATUS_ACCESS_DENIED
;
1896 /* Request PolicyPrimaryDomainInformation. */
1897 switch (lp_server_role()) {
1898 case ROLE_DOMAIN_PDC
:
1899 case ROLE_DOMAIN_BDC
:
1900 nb_name
= get_global_sam_name();
1901 /* ugly temp hack for these next two */
1903 /* This should be a 'netbios domain -> DNS domain' mapping */
1904 dnsdomname
= get_mydnsdomname(p
->mem_ctx
);
1905 if (!dnsdomname
|| !*dnsdomname
) {
1906 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO
;
1908 strlower_m(dnsdomname
);
1910 dns_name
= dnsdomname
;
1911 forest_name
= dnsdomname
;
1913 sid
= get_global_sam_sid();
1914 secrets_fetch_domain_guid(lp_workgroup(), &guid
);
1917 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO
;
1919 init_dns_dom_info(&r_u
->info
.dns_dom_info
, nb_name
, dns_name
,
1920 forest_name
,&guid
,sid
);
1923 DEBUG(0,("_lsa_query_info2: unknown info level in Lsa Query: %d\n", q_u
->info_class
));
1924 r_u
->status
= NT_STATUS_INVALID_INFO_CLASS
;
1928 if (NT_STATUS_IS_OK(r_u
->status
)) {
1930 r_u
->info_class
= q_u
->info_class
;
1935 #endif /* AD DC work in ongoing in Samba 4 */
1937 /***************************************************************************
1938 _lsa_AddAccountRights
1939 ***************************************************************************/
1941 NTSTATUS
_lsa_AddAccountRights(pipes_struct
*p
,
1942 struct lsa_AddAccountRights
*r
)
1944 struct lsa_info
*info
= NULL
;
1948 /* find the connection policy handle. */
1949 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&info
))
1950 return NT_STATUS_INVALID_HANDLE
;
1952 /* check to see if the pipe_user is a Domain Admin since
1953 account_pol.tdb was already opened as root, this is all we have */
1955 if ( p
->pipe_user
.ut
.uid
!= sec_initial_uid()
1956 && !nt_token_check_domain_rid( p
->pipe_user
.nt_user_token
, DOMAIN_GROUP_RID_ADMINS
) )
1958 return NT_STATUS_ACCESS_DENIED
;
1961 /* according to an NT4 PDC, you can add privileges to SIDs even without
1962 call_lsa_create_account() first. And you can use any arbitrary SID. */
1964 sid_copy( &sid
, r
->in
.sid
);
1966 for ( i
=0; i
< r
->in
.rights
->count
; i
++ ) {
1968 const char *privname
= r
->in
.rights
->names
[i
].string
;
1970 /* only try to add non-null strings */
1975 if ( !grant_privilege_by_name( &sid
, privname
) ) {
1976 DEBUG(2,("_lsa_AddAccountRights: Failed to add privilege [%s]\n",
1978 return NT_STATUS_NO_SUCH_PRIVILEGE
;
1982 return NT_STATUS_OK
;
1985 /***************************************************************************
1986 _lsa_RemoveAccountRights
1987 ***************************************************************************/
1989 NTSTATUS
_lsa_RemoveAccountRights(pipes_struct
*p
,
1990 struct lsa_RemoveAccountRights
*r
)
1992 struct lsa_info
*info
= NULL
;
1995 const char *privname
= NULL
;
1997 /* find the connection policy handle. */
1998 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&info
))
1999 return NT_STATUS_INVALID_HANDLE
;
2001 /* check to see if the pipe_user is a Domain Admin since
2002 account_pol.tdb was already opened as root, this is all we have */
2004 if ( p
->pipe_user
.ut
.uid
!= sec_initial_uid()
2005 && !nt_token_check_domain_rid( p
->pipe_user
.nt_user_token
, DOMAIN_GROUP_RID_ADMINS
) )
2007 return NT_STATUS_ACCESS_DENIED
;
2010 sid_copy( &sid
, r
->in
.sid
);
2012 if ( r
->in
.remove_all
) {
2013 if ( !revoke_all_privileges( &sid
) )
2014 return NT_STATUS_ACCESS_DENIED
;
2016 return NT_STATUS_OK
;
2019 for ( i
=0; i
< r
->in
.rights
->count
; i
++ ) {
2021 privname
= r
->in
.rights
->names
[i
].string
;
2023 /* only try to add non-null strings */
2028 if ( !revoke_privilege_by_name( &sid
, privname
) ) {
2029 DEBUG(2,("_lsa_RemoveAccountRights: Failed to revoke privilege [%s]\n",
2031 return NT_STATUS_NO_SUCH_PRIVILEGE
;
2035 return NT_STATUS_OK
;
2038 /*******************************************************************
2039 ********************************************************************/
2041 static NTSTATUS
init_lsa_right_set(TALLOC_CTX
*mem_ctx
,
2042 struct lsa_RightSet
*r
,
2043 PRIVILEGE_SET
*privileges
)
2046 const char *privname
;
2047 const char **privname_array
= NULL
;
2050 for (i
=0; i
<privileges
->count
; i
++) {
2052 privname
= luid_to_privilege_name(&privileges
->set
[i
].luid
);
2054 if (!add_string_to_array(mem_ctx
, privname
,
2055 &privname_array
, &num_priv
)) {
2056 return NT_STATUS_NO_MEMORY
;
2063 r
->names
= TALLOC_ZERO_ARRAY(mem_ctx
, struct lsa_StringLarge
,
2066 return NT_STATUS_NO_MEMORY
;
2069 for (i
=0; i
<num_priv
; i
++) {
2070 init_lsa_StringLarge(&r
->names
[i
], privname_array
[i
]);
2073 r
->count
= num_priv
;
2076 return NT_STATUS_OK
;
2079 /***************************************************************************
2080 _lsa_EnumAccountRights
2081 ***************************************************************************/
2083 NTSTATUS
_lsa_EnumAccountRights(pipes_struct
*p
,
2084 struct lsa_EnumAccountRights
*r
)
2087 struct lsa_info
*info
= NULL
;
2089 PRIVILEGE_SET privileges
;
2092 /* find the connection policy handle. */
2094 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&info
))
2095 return NT_STATUS_INVALID_HANDLE
;
2097 if (!(info
->access
& LSA_POLICY_VIEW_LOCAL_INFORMATION
))
2098 return NT_STATUS_ACCESS_DENIED
;
2100 /* according to an NT4 PDC, you can add privileges to SIDs even without
2101 call_lsa_create_account() first. And you can use any arbitrary SID. */
2103 sid_copy( &sid
, r
->in
.sid
);
2105 if ( !get_privileges_for_sids( &mask
, &sid
, 1 ) )
2106 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
2108 privilege_set_init( &privileges
);
2110 if ( se_priv_to_privilege_set( &privileges
, &mask
) ) {
2112 DEBUG(10,("_lsa_EnumAccountRights: %s has %d privileges\n",
2113 sid_string_dbg(&sid
), privileges
.count
));
2115 status
= init_lsa_right_set(p
->mem_ctx
, r
->out
.rights
, &privileges
);
2117 status
= NT_STATUS_NO_SUCH_PRIVILEGE
;
2120 privilege_set_free( &privileges
);
2125 /***************************************************************************
2126 _lsa_LookupPrivValue
2127 ***************************************************************************/
2129 NTSTATUS
_lsa_LookupPrivValue(pipes_struct
*p
,
2130 struct lsa_LookupPrivValue
*r
)
2132 struct lsa_info
*info
= NULL
;
2133 const char *name
= NULL
;
2134 LUID_ATTR priv_luid
;
2137 /* find the connection policy handle. */
2139 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&info
))
2140 return NT_STATUS_INVALID_HANDLE
;
2142 if (!(info
->access
& LSA_POLICY_VIEW_LOCAL_INFORMATION
))
2143 return NT_STATUS_ACCESS_DENIED
;
2145 name
= r
->in
.name
->string
;
2147 DEBUG(10,("_lsa_lookup_priv_value: name = %s\n", name
));
2149 if ( !se_priv_from_name( name
, &mask
) )
2150 return NT_STATUS_NO_SUCH_PRIVILEGE
;
2152 priv_luid
= get_privilege_luid( &mask
);
2154 r
->out
.luid
->low
= priv_luid
.luid
.low
;
2155 r
->out
.luid
->high
= priv_luid
.luid
.high
;
2157 return NT_STATUS_OK
;
2161 * From here on the server routines are just dummy ones to make smbd link with
2162 * librpc/gen_ndr/srv_lsa.c. These routines are actually never called, we are
2163 * pulling the server stubs across one by one.
2166 NTSTATUS
_lsa_Delete(pipes_struct
*p
, struct lsa_Delete
*r
)
2168 p
->rng_fault_state
= True
;
2169 return NT_STATUS_NOT_IMPLEMENTED
;
2172 NTSTATUS
_lsa_SetSecObj(pipes_struct
*p
, struct lsa_SetSecObj
*r
)
2174 p
->rng_fault_state
= True
;
2175 return NT_STATUS_NOT_IMPLEMENTED
;
2178 NTSTATUS
_lsa_ChangePassword(pipes_struct
*p
, struct lsa_ChangePassword
*r
)
2180 p
->rng_fault_state
= True
;
2181 return NT_STATUS_NOT_IMPLEMENTED
;
2184 NTSTATUS
_lsa_SetInfoPolicy(pipes_struct
*p
, struct lsa_SetInfoPolicy
*r
)
2186 p
->rng_fault_state
= True
;
2187 return NT_STATUS_NOT_IMPLEMENTED
;
2190 NTSTATUS
_lsa_ClearAuditLog(pipes_struct
*p
, struct lsa_ClearAuditLog
*r
)
2192 p
->rng_fault_state
= True
;
2193 return NT_STATUS_NOT_IMPLEMENTED
;
2196 NTSTATUS
_lsa_GetQuotasForAccount(pipes_struct
*p
, struct lsa_GetQuotasForAccount
*r
)
2198 p
->rng_fault_state
= True
;
2199 return NT_STATUS_NOT_IMPLEMENTED
;
2202 NTSTATUS
_lsa_SetQuotasForAccount(pipes_struct
*p
, struct lsa_SetQuotasForAccount
*r
)
2204 p
->rng_fault_state
= True
;
2205 return NT_STATUS_NOT_IMPLEMENTED
;
2208 NTSTATUS
_lsa_QueryTrustedDomainInfo(pipes_struct
*p
, struct lsa_QueryTrustedDomainInfo
*r
)
2210 p
->rng_fault_state
= True
;
2211 return NT_STATUS_NOT_IMPLEMENTED
;
2214 NTSTATUS
_lsa_SetInformationTrustedDomain(pipes_struct
*p
, struct lsa_SetInformationTrustedDomain
*r
)
2216 p
->rng_fault_state
= True
;
2217 return NT_STATUS_NOT_IMPLEMENTED
;
2220 NTSTATUS
_lsa_QuerySecret(pipes_struct
*p
, struct lsa_QuerySecret
*r
)
2222 p
->rng_fault_state
= True
;
2223 return NT_STATUS_NOT_IMPLEMENTED
;
2226 NTSTATUS
_lsa_LookupPrivName(pipes_struct
*p
, struct lsa_LookupPrivName
*r
)
2228 p
->rng_fault_state
= True
;
2229 return NT_STATUS_NOT_IMPLEMENTED
;
2232 NTSTATUS
_lsa_EnumAccountsWithUserRight(pipes_struct
*p
, struct lsa_EnumAccountsWithUserRight
*r
)
2234 p
->rng_fault_state
= True
;
2235 return NT_STATUS_NOT_IMPLEMENTED
;
2238 NTSTATUS
_lsa_QueryTrustedDomainInfoBySid(pipes_struct
*p
, struct lsa_QueryTrustedDomainInfoBySid
*r
)
2240 p
->rng_fault_state
= True
;
2241 return NT_STATUS_NOT_IMPLEMENTED
;
2244 NTSTATUS
_lsa_SetTrustedDomainInfo(pipes_struct
*p
, struct lsa_SetTrustedDomainInfo
*r
)
2246 p
->rng_fault_state
= True
;
2247 return NT_STATUS_NOT_IMPLEMENTED
;
2250 NTSTATUS
_lsa_DeleteTrustedDomain(pipes_struct
*p
, struct lsa_DeleteTrustedDomain
*r
)
2252 p
->rng_fault_state
= True
;
2253 return NT_STATUS_NOT_IMPLEMENTED
;
2256 NTSTATUS
_lsa_StorePrivateData(pipes_struct
*p
, struct lsa_StorePrivateData
*r
)
2258 p
->rng_fault_state
= True
;
2259 return NT_STATUS_NOT_IMPLEMENTED
;
2262 NTSTATUS
_lsa_RetrievePrivateData(pipes_struct
*p
, struct lsa_RetrievePrivateData
*r
)
2264 p
->rng_fault_state
= True
;
2265 return NT_STATUS_NOT_IMPLEMENTED
;
2268 NTSTATUS
_lsa_QueryInfoPolicy2(pipes_struct
*p
, struct lsa_QueryInfoPolicy2
*r
)
2270 p
->rng_fault_state
= True
;
2271 return NT_STATUS_NOT_IMPLEMENTED
;
2274 NTSTATUS
_lsa_SetInfoPolicy2(pipes_struct
*p
, struct lsa_SetInfoPolicy2
*r
)
2276 p
->rng_fault_state
= True
;
2277 return NT_STATUS_NOT_IMPLEMENTED
;
2280 NTSTATUS
_lsa_QueryTrustedDomainInfoByName(pipes_struct
*p
, struct lsa_QueryTrustedDomainInfoByName
*r
)
2282 p
->rng_fault_state
= True
;
2283 return NT_STATUS_NOT_IMPLEMENTED
;
2286 NTSTATUS
_lsa_SetTrustedDomainInfoByName(pipes_struct
*p
, struct lsa_SetTrustedDomainInfoByName
*r
)
2288 p
->rng_fault_state
= True
;
2289 return NT_STATUS_NOT_IMPLEMENTED
;
2292 NTSTATUS
_lsa_EnumTrustedDomainsEx(pipes_struct
*p
, struct lsa_EnumTrustedDomainsEx
*r
)
2294 p
->rng_fault_state
= True
;
2295 return NT_STATUS_NOT_IMPLEMENTED
;
2298 NTSTATUS
_lsa_CreateTrustedDomainEx(pipes_struct
*p
, struct lsa_CreateTrustedDomainEx
*r
)
2300 p
->rng_fault_state
= True
;
2301 return NT_STATUS_NOT_IMPLEMENTED
;
2304 NTSTATUS
_lsa_CloseTrustedDomainEx(pipes_struct
*p
, struct lsa_CloseTrustedDomainEx
*r
)
2306 p
->rng_fault_state
= True
;
2307 return NT_STATUS_NOT_IMPLEMENTED
;
2310 NTSTATUS
_lsa_QueryDomainInformationPolicy(pipes_struct
*p
, struct lsa_QueryDomainInformationPolicy
*r
)
2312 p
->rng_fault_state
= True
;
2313 return NT_STATUS_NOT_IMPLEMENTED
;
2316 NTSTATUS
_lsa_SetDomainInformationPolicy(pipes_struct
*p
, struct lsa_SetDomainInformationPolicy
*r
)
2318 p
->rng_fault_state
= True
;
2319 return NT_STATUS_NOT_IMPLEMENTED
;
2322 NTSTATUS
_lsa_OpenTrustedDomainByName(pipes_struct
*p
, struct lsa_OpenTrustedDomainByName
*r
)
2324 p
->rng_fault_state
= True
;
2325 return NT_STATUS_NOT_IMPLEMENTED
;
2328 NTSTATUS
_lsa_TestCall(pipes_struct
*p
, struct lsa_TestCall
*r
)
2330 p
->rng_fault_state
= True
;
2331 return NT_STATUS_NOT_IMPLEMENTED
;
2334 NTSTATUS
_lsa_CreateTrustedDomainEx2(pipes_struct
*p
, struct lsa_CreateTrustedDomainEx2
*r
)
2336 p
->rng_fault_state
= True
;
2337 return NT_STATUS_NOT_IMPLEMENTED
;
2340 NTSTATUS
_lsa_CREDRWRITE(pipes_struct
*p
, struct lsa_CREDRWRITE
*r
)
2342 p
->rng_fault_state
= True
;
2343 return NT_STATUS_NOT_IMPLEMENTED
;
2346 NTSTATUS
_lsa_CREDRREAD(pipes_struct
*p
, struct lsa_CREDRREAD
*r
)
2348 p
->rng_fault_state
= True
;
2349 return NT_STATUS_NOT_IMPLEMENTED
;
2352 NTSTATUS
_lsa_CREDRENUMERATE(pipes_struct
*p
, struct lsa_CREDRENUMERATE
*r
)
2354 p
->rng_fault_state
= True
;
2355 return NT_STATUS_NOT_IMPLEMENTED
;
2358 NTSTATUS
_lsa_CREDRWRITEDOMAINCREDENTIALS(pipes_struct
*p
, struct lsa_CREDRWRITEDOMAINCREDENTIALS
*r
)
2360 p
->rng_fault_state
= True
;
2361 return NT_STATUS_NOT_IMPLEMENTED
;
2364 NTSTATUS
_lsa_CREDRREADDOMAINCREDENTIALS(pipes_struct
*p
, struct lsa_CREDRREADDOMAINCREDENTIALS
*r
)
2366 p
->rng_fault_state
= True
;
2367 return NT_STATUS_NOT_IMPLEMENTED
;
2370 NTSTATUS
_lsa_CREDRDELETE(pipes_struct
*p
, struct lsa_CREDRDELETE
*r
)
2372 p
->rng_fault_state
= True
;
2373 return NT_STATUS_NOT_IMPLEMENTED
;
2376 NTSTATUS
_lsa_CREDRGETTARGETINFO(pipes_struct
*p
, struct lsa_CREDRGETTARGETINFO
*r
)
2378 p
->rng_fault_state
= True
;
2379 return NT_STATUS_NOT_IMPLEMENTED
;
2382 NTSTATUS
_lsa_CREDRPROFILELOADED(pipes_struct
*p
, struct lsa_CREDRPROFILELOADED
*r
)
2384 p
->rng_fault_state
= True
;
2385 return NT_STATUS_NOT_IMPLEMENTED
;
2388 NTSTATUS
_lsa_CREDRGETSESSIONTYPES(pipes_struct
*p
, struct lsa_CREDRGETSESSIONTYPES
*r
)
2390 p
->rng_fault_state
= True
;
2391 return NT_STATUS_NOT_IMPLEMENTED
;
2394 NTSTATUS
_lsa_LSARREGISTERAUDITEVENT(pipes_struct
*p
, struct lsa_LSARREGISTERAUDITEVENT
*r
)
2396 p
->rng_fault_state
= True
;
2397 return NT_STATUS_NOT_IMPLEMENTED
;
2400 NTSTATUS
_lsa_LSARGENAUDITEVENT(pipes_struct
*p
, struct lsa_LSARGENAUDITEVENT
*r
)
2402 p
->rng_fault_state
= True
;
2403 return NT_STATUS_NOT_IMPLEMENTED
;
2406 NTSTATUS
_lsa_LSARUNREGISTERAUDITEVENT(pipes_struct
*p
, struct lsa_LSARUNREGISTERAUDITEVENT
*r
)
2408 p
->rng_fault_state
= True
;
2409 return NT_STATUS_NOT_IMPLEMENTED
;
2412 NTSTATUS
_lsa_lsaRQueryForestTrustInformation(pipes_struct
*p
, struct lsa_lsaRQueryForestTrustInformation
*r
)
2414 p
->rng_fault_state
= True
;
2415 return NT_STATUS_NOT_IMPLEMENTED
;
2418 NTSTATUS
_lsa_LSARSETFORESTTRUSTINFORMATION(pipes_struct
*p
, struct lsa_LSARSETFORESTTRUSTINFORMATION
*r
)
2420 p
->rng_fault_state
= True
;
2421 return NT_STATUS_NOT_IMPLEMENTED
;
2424 NTSTATUS
_lsa_CREDRRENAME(pipes_struct
*p
, struct lsa_CREDRRENAME
*r
)
2426 p
->rng_fault_state
= True
;
2427 return NT_STATUS_NOT_IMPLEMENTED
;
2430 NTSTATUS
_lsa_LSAROPENPOLICYSCE(pipes_struct
*p
, struct lsa_LSAROPENPOLICYSCE
*r
)
2432 p
->rng_fault_state
= True
;
2433 return NT_STATUS_NOT_IMPLEMENTED
;
2436 NTSTATUS
_lsa_LSARADTREGISTERSECURITYEVENTSOURCE(pipes_struct
*p
, struct lsa_LSARADTREGISTERSECURITYEVENTSOURCE
*r
)
2438 p
->rng_fault_state
= True
;
2439 return NT_STATUS_NOT_IMPLEMENTED
;
2442 NTSTATUS
_lsa_LSARADTUNREGISTERSECURITYEVENTSOURCE(pipes_struct
*p
, struct lsa_LSARADTUNREGISTERSECURITYEVENTSOURCE
*r
)
2444 p
->rng_fault_state
= True
;
2445 return NT_STATUS_NOT_IMPLEMENTED
;
2448 NTSTATUS
_lsa_LSARADTREPORTSECURITYEVENT(pipes_struct
*p
, struct lsa_LSARADTREPORTSECURITYEVENT
*r
)
2450 p
->rng_fault_state
= True
;
2451 return NT_STATUS_NOT_IMPLEMENTED
;